Minimal Observability for Transactional Hierarchical Services ∗ Debmalya Biswas and Blaise Genest IRISA/INRIA & CNRS, Campus de Beaulieu, 35042 Rennes Cedex, France {firstname.lastname}@irisa.fr Abstract For complex services, logging is an integral part of many middleware aspects, especially, transactions and monitoring. In the event of a failure, the log allows us to deduce the cause of failure (diagnosis), recover by compensating the logged actions (atomicity), etc. However, for heterogeneous services, logging all the actions is often impracticable due to privacy/security constraints. Also, logging is expensive in terms of both time and space. Thus, we are interested in determining the absolute minimal number of actions that needs to be logged, to know with certainty the actual sequence of executed actions from any given partial log. This problem happens to be NP-Complete. We consider complex services represented as a hierarchy of services, and propose a decomposition mechanism which dramatically decreases the complexity (up to 2 exponentials).

1. Introduction An interesting problem for complex systems is to determine a minimal set of actions that needs to be observable such that a given property holds. Some of the properties studied in literature of discrete event systems are normality [6], observability [5], state observability [9], diagnosability [13], etc. Our system corresponds to a composite (workflow) Web service. A Web service [1] refers to an online service accessible via Internet standard protocols. A composite service, composed of already existing (component) services, combines the capabilities of its components to provide a new service. A service schema which specifies the execution order of its components, can be modeled as a graph, performing actions on global variables. We do not tackle here the modelization of a service as a graph, which should be handled with care to yield a graph of reasonable size (see [15] and example 1). Our long-term objective is to provide a transactional framework for (composite) Web services. A transaction ∗ This

work is supported by la Region Bretagne (CREATE ACTIVEDOC) and ANR-06-MDCA-005 DOCFLOW.

can be considered as a group of actions encapsulated by the operations Begin and Commit/Abort, having the following properties: Atomicity (A), Consistency (C), Isolation (I) and Durability (D). Here, we focus on the atomicity aspect, that is, either all the actions of a transaction are executed or none. In the event of a failure, atomicity is preserved by compensation [3, 14]. Compensation consists of executing the compensating actions, corresponding to each executed action of the failed process, in reverse order of the original execution. Many advanced transactional models have also been proposed, e.g. “semantic compensation” [14] which do not require any knowledge of the execution sequence. However, their application to more autonomous systems like Web Services has been limited, where the default compensation mechanism of the widely used Business Process Execution Language (BPEL) is to “execute the completed actions in reverse order”. Thus, for compensation to be feasible, we need to reconstruct each executed action or the complete history of any execution. To achieve that, we maintain a log of the observable actions. In addition to the obvious space overhead of logging, the complete log may not always be accessible. For a composite service, the providers of its component services are different. As such, their privacy/security constraints may prevent them from exposing (part of) the logs corresponding to the execution at their sites. Also, heterogeneity may lead to the logs being maintained in different formats, rendering some of them incomprehensible. Existing Web services specifications to provide transactional guarantees, such as WS-Coordination, WS-AtomicTransaction and WS-BusinessActivity [16], are basically distributed agreement protocols which are based on the assumption that “all state transitions are reliably recorded” and can be compensated. Our approach is targeted towards a more heterogeneous environment where all transitions may not be observable. Hence, we want from a partial log of the observable actions to know with certainty the actual sequence of executed actions, to be able to compensate it. Section 2 introduces the required formal preliminaries including the precise problem statement. Clearly, we are interested in logging the smallest number of actions possi-

ble. However, determining the minimal number of actions to log, such that any execution of a system is compensable, is NP-Complete. This is not very surprising, since the closely related sensor selection problems [17, 8] are also NP-Complete (see section 3). Also, the problem cannot be approximated [11] in polynomial time, which means that polynomial time algorithms cannot give a minimal set for all graphs, and that for many graphs, the observable set produced would be much bigger than the minimal set. A complex service is often constructed hierarchically (see section 4), with some services at a high level corresponding to many composite services at a lower level. Each hierarchical level potentially describes the interactions at a different level of abstraction, e.g., the top level may describe the interactions between several providers, then the next level between services of a provider, and so on. Moreover, components can be reused in a hierarchical system, giving a compressed way to represent big systems. Hierarchical systems are often used for words [10], Finite State Machines [2], and even trees [7]. For words, e.g., hierarchical structures correspond to the LZ compression [10]. We show in section 5 how to use the hierarchical representation to compute efficiently a minimal observable set of transitions. The algorithm is not straightforward since the log of both minimal sets of actions of different components is not necessarily enough to recover the actual sequence of executed actions of the whole graph. One solution could be to resort to function summarization, but then only an overapproximation of the minimal set of actions would be obtained. Nevertheless, we show that it suffices to run the algorithm with slightly different parameters on each component. We thus obtain a divide and conquer algorithm. We present a theoretical complexity analysis which illustrates the benefit of our method (up to two exponentials better when using the full hierarchical representation and one exponential better by using the hierarchical representation even if components are used only once, compared to flattening the hierarchical graph), that is verified experimentally (section 6). Proofs and details omitted for lack of space can be found in [4].

2. Preliminaries Formally, we model a transactional service as a 4-tuple M = (Q, s0 , sf , T ), where (Q, T ) is a graph (q ∈ Q is called a state and t ∈ T a transition) and s 0 ∈ Q and sf ∈ Q are the initial and final states, respectively. Our systems are thus graphs with a unique input and output point, each node and arc corresponds to a state and transition, but we ignore the alphabet. We assume that the service M does not have any unreachable states and that all states can reach the final state sf . For convenience, we also assume that there are no outgoing edges from s f and

no incoming edges to s 0 .1 We say that an execution sequence ρ = τ1 · · · τn ∈ T ∗ is a path of M if there exists q0 , · · · , qn ∈ Qn+1 with τi = (qi−1 , qi ) for all 1 ≤ i ≤ n. A path is called initial if furthermore q 0 = s0 . We denote by P(M ) the set of initial paths in M . Finally, we denote by |M | the size of M , that is, its number of transitions. In general, for any execution ρ, we call observation projections the observation we have after ρ was executed (a sequence of actions, control points, data . . . ). We say that an observable projection σ is uncertain if there exists two paths having the same projection. The service M is execution sequence detectable iff none of its observable projections are uncertain. Definition 1 Let TO ⊆ T be the set of observable transitions. The observation projection Obs O : T ∗ −→ TO∗ is the morphism with ObsO (a1 . . . an ) = o1 · · · on with oi = ai if ai ∈ TO , and oi =  if ai ∈ T \ TO , with  the empty word. That is, ObsO (ρ) is the subsequence of ρ obtained by eliminating from ρ every occurrence of a tuple which is not in TO . With such an observation projection Obs O , the only way of having execution sequence detectability is to have every transition observable. Indeed, as soon as there exists even one non-observable transition, the service is not execution sequence detectable. Else, let us take a path ρτ with the last transition τ ∈ / TO . Then, ObsO (ρτ ) = ObsO (ρ). An usual way to overcome such a problem is to ask for certainty only up to the last few events of the sequence [9]. However, this workaround does not make sense in our framework since if we cannot compensate the very last action, then we cannot compensate any action at all. As such, we design a new observation mechanism, where the last control point reached before failure is monitored, even if the last action is not logged. In practice, it means that every state that is reached is monitored, and overwrite the previous state in a special memory buffer. Definition 2 Let M be a service, TO ⊆ T . The observa∗ tion projection Obs last −→ (TO∗ , Q) is the function O : T last ObsO (ρ) = (ObsO (ρ), q) for all ρ ∈ P(M ) ending in q. We will stick with this definition of observability for the rest of the paper. As mentioned before, we are interested in logging as few transitions as possible. Problem statement. Given an service M = (Q, s 0 , sf , T ), we call TO an observable set of transitions if the service is execution sequence detectable with Obs last O . We want to determine a minimal observable set of transitions T O ⊆ T . The cardinality of such a minimal observable set T O of a service M is referred to as its observable size M O(M ) = 1 Notice that we could deal with a service without these requirements, but the proof would be more technical.

Get Supervisor's Approval

$

Currency Type?

Finance Director's approval?

Y

Order American Express Cheque

Y N Student ?

Initiate Payment Request

Euro Get Team Lead's Approval

Terminate Request

N Order Citibank Cheque

Deliver Cheque

ican Express or Citibank cheque was processed. With TO = {e2 , e6 , e9 }, we have Obslast O (e1 e2 e5 e7 ) = (e2 , s5 ) = last (e e e e e ) = (e e , s Obslast 1 2 4 6 7 2 6 5 ) = ObsO (e1 e2 e4 e6 ) = O (e2 e6 , s4 ), and TO is an observable set of transitions. Every path from s0 to sf uses at least one transition from T O . Order American s2 Process $ Exp. Cheque (e5) (e2) Process Euros on

Update Accounts Database

s0

Initiate Delivery

Geographic Location?

Different campus

s1 Initiate Funds Request (e1)

Send by Courier Terminate Delivery

Finance Director's Reject (e4) Process Euros (e3)

s3

s4 Order Citibank Cheque (e6)

Update Accounts Database (e7)

Send by courier (e8)

s5

sf Hand deliver (e9)

Hand Deliver Same campus

Figure 2. Modelization of Fig. 1. Figure 1. Travel funds request workflow.

3. Problem Hardness |TO |. Notice that as is usual with decision and computation algorithms, it is sufficient to have an algorithm which from a service gives its observable size. That is, we can derive a minimal observable set of the service based on knowledge of its observable size in polynomial time. Example 1 We consider in Fig. 1 a travel funds request service, inspired by the workflow in [12]. It involves different departments across organizations, and it is hierarchical in that the deliver cheque service is hierarchically described. We model the service using the service M = (S, s0 , sf , T ), as shown in Fig. 2. Notice that this service is a simplification, since for instance the choice between the team leader or supervisor approvals is not represented. The reason is that they are both associated with an empty compensating transition, hence knowing which path was taken here is not necessary to be able to perform recovery. However, it is necessary to know which bank issued the cheque in order to be able to compensate it, by a “Cancel Last American Express (Citibank) Cheque”. Note that we do not exclude the logging of data values (in some persistent storage) required for compensation. For instance, if there wasn’t any “Cancel Last Cheque” mechanism, then it would be needed to log the amount and account number associated with the ’‘Update Accounts Database” transition. Recovery would manually credit the amount of money written in the log to the corresponding account. Obviously, we cannot save on logging the data values, but we optimize the logging associated with the path visited. Our experiments performed on BPEL representations of some workflows reveal that one transition out of five is logged (which is confirmed in section 6) and that data values logs are small compared to logging the path. Now, let TO = {e2 , e3 , e9 } and a failure occurs while processing e8 , that is, the cheque is not issued or delivered correctly. Then, Obslast O (e1 e2 e5 e7 ) = (e2 , s5 ) = Obslast O (e1 e2 e4 e6 e7 ). Thus, we do not know if an Amer-

We first relate the problem of computing M O(M ) using our definition of observable projections with other known problems. We state now that computing the minimal observable set is equivalent to the uniconnected subgraph problem, also called the minimal marker placement problem [8], in the meaning of the following proposition. Proposition 1 Let M be a service and T O a subset of transitions of M . Denote by M  the service M obtained by deleting all transitions belonging to T O . Then, TO is an observable set of M iff there does not exist a pair of paths ρ1 = ρ2 of M  with ρ1 beginning and ending at the same states as ρ2 . To prove proposition 1, it suffices to prove that if there does not exist a pair of paths ρ 1 = ρ2 of M  with ρ1 beginning and ending at the same states as ρ 2 , then from any observable projection (σ, q n+1 ), we can reconstruct in a unique way a path with Obs last O (ρ) = (σ, qn+1 ). The converse is trivial. Indeed, it suffices to define the only path ρi of M  between qi and qi+1 for σ = (qi , qi )ni=1 , and i = 0 · · · n (we fix q0 = s0 the initial state of M  , and recall that qn+1 is the last observed state). Then, the path ρ = ρ0 (q1 , q1 )ρ1 · · · (qn , qn )ρn is the only path with last πO (ρ) = (σ, qn+1 ). The search for each path ρ i can be performed in linear time by a simple depth first search of M . The fact is that the marker placement problem is an NPComplete problem. The question is then to know if there is a structural subclass of graphs which has a tractable algorithm to give the minimal observable size. We know from [8] that the minimal marker placement problem is NPComplete even for acyclic graphs. However, the proof uses a graph with unbounded (in and out) degree. We show that the problem is NP-Complete even if the graph is both acyclic and the sum of its in and outdegree bounded by 3

(that is, indegree 2 and outdegree 1, or vice versa). The core of the proof follows the same strategy as [8], but the encoding to get a unique starting and ending point is both easier to understand and allows a lower in and outdegree. Theorem 1 Let M be a service, and k a number. Knowing whether M O(M ) ≤ k is NP-Complete, even if the corresponding graph is acyclic and the sum of in and outdegree of every node bounded by 3. This theorem does not mean that the problem is impossible to solve, but that it cannot be solved for all possible services. For instance, the complexity of the brute force method which generates every subset of transitions and tests whether it is observable, is O(2 |M| ) for a service M with |M | transitions. The question then is which structural property makes the problem easier to solve and often holds for (real life) composite services. We propose hierarchical services as a candidate property.

4. Hierarchical Services Hierarchical services provide an efficient way to model large and complex services by allowing a modular decomposition. We consider hierarchical services where two transitions (supertransitions) can be further refined into another service. A hierarchical service H is a finite sequence Mi i=1···n , where M i = (Qi , si0 , sif , T i , (τ1i , k1i ), (τ2i , k2i )) is defined as follows: • (Qi , T i ) is a finite graph, • si0 and sif are the initial and final states, respectively, • τ1i , τ2i ∈ T i ∪ {} are two supertransitions representing i i services M k1 , M k2 respectively, with k1i , k2i > i. For instance, the workflow in Fig. 1 can be described by a hierarchical service M 1 , M2 , where M2 is made of an initial and final state, and two transitions e 8 , e9 from the initial to the final state. The service M 1 is very similar to Fig. 2, except that there is a unique transition e 10 between s5 and sf instead of two. This is a supertransition (τ 11 , k11 ), with τ11 = e10 and k11 = 2, meaning that e 10 represents M2 . With each hierarchical service H, we associate an ordinary service H obtained by taking M i , and recursively substituting each supertransition by the service it represents. For example 1, H is depicted in Fig. 2. Given a hierarchical service Hn , Hj is a component of H i , if there is a supertransition (t, j) in H i . We define the size |H| of a hierarchical service H as the sum of the number of transitions of its components M i . Its diameter ||H|| is the number of transitions of H. The diameter ||H|| of H can be exponential in the size of H, because components can be reused several times (for instance, a supertransition of H 3 and two

supertransitions of H 4 can represent H 10 , in which case one does not need to redefine H 10 three times). Now, let us define a hierarchical system H with two levels. The top level H1 has two states, one initial and one final, with two transitions τ1 , τ2 from the initial to the final state. Transition τ2 is a supertransition. It is not easy to determine a minimal set of transitions for H. Consider first that τ2 describes a system H2 similar to H1 , that is two transitions τ3 , τ4 from the initial to the final state, but without supertransitions. The set T 2 = {τ3 } is a minimal observable set of transitions for H 2 . Now, looking at H 1 as a normal system (without supertransitions), T 1 = {τ1 } is also a minimal observable set of transitions for H 1 . We have furthermore that T 1 ∪ T2 is a minimal observable set of transitions for H. However, if we take H 2 to be the system described in Fig. 2 and the associated minimal observable set T 2 = TO = {e2 , e6 , e9 } of transitions described in example 1, then T1 ∪ T2 is not minimal among the observable set of transitions for H. The reason is that T 2 is already an observable set of transitions, because all paths that pass through H2 use at least one transition in T O , so they can be differentiated from the path τ 1 . That is, the fact that a subset of transitions is a minimal observable set of transitions is global to the whole graph, not local.

5. Algorithm for Minimal Observability We turn now to defining an algorithm which uses the hierarchical structure of a complex service to compute the minimal observable set. First, we need the following notations. Given TO , a path ρ is said to be an unobserved path if it does not use any transition of T O . For a service M and a set of transitions T O of M , we define the following predicates: • P0 (M, TO ) holds if there does not exist more than one unobserved path between any two states s 1 = s2 ∈ Q (TO is an observable set of transitions). • P1 (M, TO ) holds if (i) P0 (M, TO ) holds, and (ii) there does not exist an unobserved path from s 0 to sf . • P1 (M, TO ) holds if (i) P0 (M, TO ) holds, and (ii) there do not exist states s 1 , s2 ∈ Q such that (a) there is an unobserved path from s 0 to s2 , (b) there is an unobserved path from s 1 to sf , and (c) there is an unobserved path from s 1 to s2 . We refer to such a combination of nodes and edges as an unobserved reverse cyclic pattern between s 1 and s2 (within M ) . For instance, on Fig. 2 with T O = {e2 , e6 , e9 }, P0 (TO ) holds because TO is observable, P1 (TO ) holds because every path from s 0 to sf uses at least one transition of T O ,

but P1 (TO ) does not hold since there exists three non observable paths: e4 from s2 to s3 / e1 e3 from s0 to s3 / e5 e7 e8 from s2 to sf . By definition, P1 (M, TO ) ⇒ P1 (M, TO ) ⇒ P0 (M, TO ), since for all s, there always exists a path from s to s. Let  < 0 < 1 < 1  . We define Best(M, TO ) = x ∈ {, 0, 1, 1} such that Px (M, TO ) holds, but not P xx (M, TO ) with xx > x, with the convention P (M, TO ) is always true. Informally, Best refers to the best properties a given set of transitions can ensure, if observed. Proposition 2 Let C be a component of M , and T 1 , T2 be subsets of transitions of C, respectively such that Best(C, T1 ) = Best(C, T2 ). Then, for all subset of transitions TO of M \ C, we have Best(M, TO ∪ T1 ) = Best(M, TO ∪ T2 ). For x ∈ {0, 1, 1}, we define Tx (M ) as a smallest subset TO of transitions of M such that P x (M, TO ) holds. For a subset of transitions T of a component C of M , we also denote by T xT,C (M ) a smallest set TO such that TO ∩ C = T and Px (M, TO ) holds. Every algorithm to compute the minimal observable set of transitions is recursive, taking the set of transitions considered observable as input. It is easy to modify them to input in the beginning not ∅ but T , and disallowing to select any new transitions in C, such that they compute T xT,C (M ), and they do it faster than Tx (M ) because they cannot choose among the transitions of C. As proved in proposition 2, the size of TO is constant for several T such that Best(C, T ) = y. If |T  | > |T | with Best(C, T ) = Best(C, T  ), then  |TxT ,C (M )| > |TxT,C (M )|. We can use this idea to compute Tx (M ) in a compositional manner, for a service M having component C: MinimalDecomposition(M, C): 1. Compute a minimal set T y (C) of transitions of C, ∀y ∈ {0, 1, 1}. Ty (C),C

2. Compute a minimal set T 0 M , ∀y ∈ {0, 1, 1}.

s1

s2

s' f

sf

Figure 3. Service M = (Q, s0 , sf , T ) having component C = (Q , s0 , sf , T  ). T1 (C),C

and T0 size 3.

T1 (C),C

3. T0

(M ) = {(s0 , s2 ), (s1 , sf ), (s1 , s2 )} of

(M ) is a minimal observable set of M .

We can now state the main theorem of the paper. Theorem 2 Let H = (Mi )ni=1 be a hierarchical service. It is NP-complete in the size of H compute M O(H). Moreto n over, it takes at most time O( i=1 2|Mi | ). It is important to notice that since a service is in particular a hierarchical service (with hierarchy height of 1), we know that the problem is at least NP-hard. However, the complexity could be exponentially worse for hierarchical graphs, since a small hierarchical graph can represent an exponentially bigger flat graph. We prove that this is not the case. Moreover, we prove that the complexity is linear in the number of components, and exponential only in the size of each base component. That is, we prove that with a smart algorithm, one can compute efficiently the absolute minimal observable size even for huge hierarchical systems, as long as each component is small enough. The best case comparison is with respect to a hierarchical service of diameter O(2n ), having n base components of size 2 (each one being reused 2 n−1 times). The brute force non-compositional n method runs on H and takes time O(2 2 ), while our method takes O(n), that is a doubly exponential improvement (one exponential due to the reuse of components, and another due to decomposition).

6. Experimental Results Ty (C),C

(M ).

For example, consider the service M having component C in Fig. 3. 1. A minimal set T0 (C) = {(s0 , s2 ), (s1 , sf )}, T1 (C) = {(s0 , s1 ), (s2 , sf )}, and T1 (C) = {(s0 , s2 ), (s1 , sf ), (s1 , s2 )}. 2. The corresponding observable sets of M : T (C),C T0 0 (M ) = {(s0 , s2 ), (s1 , sf ), (s0 , sf )} of T1 (C),C

s' 0

(M ) of transitions of

3. Output a set of smallest size among T 0

size 3, T0

s0

(M ) = {(s0 , s1 ), (s2 , sf )} of size 2,

We tested our decomposition algorithm on hierarchical graphs. First, we choose a number (between one and nine) of base subcomponents in the graph. Then, we generate each of them randomly by using the Synthetic DAG generation tool (http://www.loria.fr/˜suter/dags.html). We then generate inductively a hierarchical graph having these base subcomponents randomly using the same tool, by assigning two edges to these components. There is no reuse of components. For each value, we generate each hierarchical graph and each base subcomponent five times to compute the mean values (because of variation in runtime and

25

1000

23

Decomposition Brute Force mean decomp.

10

"mean brute"

1

0,1

0,01

21 % of logged edges

seconds (log scale)

100

19 17 15 13 11 9

values

7

(1) 0

(2)

(3)

(4)

(5)

(6)

(7)

(8)

20 40 60 80 100 Number of edges (nbr. of subcomponents)

(9)

mean values

5 0

20

40

60

80

100

number of edges

Figure 4. Execution time & observable size observable size). We then unfold the hierarchical graphs as (flat) graphs, whose size is linear in the number of base components. We then run both a brute force algorithm and our hierarchical algorithm on these graphs. We do not input the hierarchical shape of the graph, instead the algorithm finds the optimal decomposition with a polynomial time algorithm, see [4]. Fig. 4(left) shows the times (in logarithmic scale) needed to compute a minimal observable set using brute force and our decomposition algorithm with respect to the number of edges (which is linear with respect to the number of base subcomponents). Our decomposition algorithm is indeed linear time with respect to the number of base subcomponents/number of edges (0.14s for an average number of edges of 18 and 0.73s for an average number of edges of 108), while the brute force is exponential in the number of edges, already timing out at a little over 40 edges. For 1 subcomponent, the overhead of our method makes the decomposition slightly worse than the brute force method. Fig. 4(right) shows the percentage of edges needed to be logged among all the edges. Both algorithms answer the same number on the same graphs but there is a huge variation among graphs, from one edge needs to be logged out of 4 to one edge out of 15. The mean value seems to tend to one out of 6.

7. Discussion and Conclusion We studied compensation under partial log visibility. To the best of our knowledge, this problem has never been considered in the context of transactional services. We proposed a framework which uses the hierarchical nature of composite services, and gives an efficient algorithm to compute the absolute minimum number of transitions to observe in order to get compensability. The algorithm we proposed considers only a subset of the whole set of transitions. It is thus straightforward to add constraints, such as, a subset of transitions “can/cannot be observed”. It is very useful since in practice, we have to take into account privacy/security issues. The algorithm would then answer the absolute minimal observable set among those satisfying the constraints. Also, the hierarchical decomposition allows to deal with dynamicity. Indeed, if a service gets transformed (e.g., after the discovery/death of

a sub-service), obtaining a minimal observable set would need recomputation, only at its level of the hierarchy (not below), plus few levels above (until the properties of a level are unchanged). It also allows to describe more accurately the details of a service which was considered atomic until now, in order to have feedback on where a service failed exactly. We explain in [4] how to deal with distributed systems, and with systems which are not given in a hierarchical way (using a folding algorithm).

References [1] G. Alonso, F. Casati, H. Kuno, and V. Machiraju. Web Services: Concepts, Architecture and Applications. Springer Verlag, ISBN: 3540440089, 2004. [2] R. Alur and M. Yannakakis. Model checking of hierarchical state machines. ACM TOPLAS, 23(3), pages 1–31, 2001. [3] D. Biswas. Compensation in the world of web services composition. In SWSWPC, pages 69–80, 2004. [4] D. Biswas and B. Genest. Minimal observability for transactional hierarchical services. available at http://www.crans.org/˜genest/BG08.pdf. [5] R. Kumar and V. Garg. Modeling and control of logical discrete event systems. Kluwer Academic, 1995. [6] F. Lin and W. Wonham. On observability of discrete-event systems. Information Sciences, 44(3), pages 173–198, 1988. [7] M. Lohrey and S. Manneth. The complexity of tree automata and xpath on grammar-compressed trees. Theoretical Computer Science, 363(2), pages 196–210, 2006. [8] S. Maheshwari. Traversal marker placement problems are np-complete. Boulder Univ. Report CU-CS-092-76, 1976. [9] C. Ozveren and A. Wilsky. Observability of discrete event dynamical systems. IEEE Trans. Auto. Control, 35(7), pages 797–806, 1990. [10] W. Plandowski and W. Rytter. Complexity of language recognition problems for compressed words. In Jewels are Forever, Springer, pages 262–272, 1999. [11] K. Rohloff and J. Schuppen. Approximating the minimal cost sensor selection for discrete-event systems. JDEDS, 16(1), pages 143–170, 2006. [12] W. Sadiq and M. Orlowska. Analyzing process models using graph reduction techniques. Inf. Syst., 25(2), pages 117–134, 2000. [13] M. Sampath, R. Sengupta, S. Lafortune, K. Sinaamohideen, and D. Teneketzis. Diagnosability of discrete event systems. IEEE Trans. Auto. Control, 40(9), pages 1555–1575, 1995. [14] G. Weikum, A. Deacon, W. Schaad, and S. H. Open nested transactions in federated database systems. IEEE Data Engg. Bulletin, 16(2), pages 4–7, 1993. [15] A. Wombacher, P. Fankhauser, and E. Neuhold. Transforming bpel into annotated deterministic finite state automata for service discovery. In ICWS, pages 316–323, 2004. [16] Web services transactions specifications. http://msdn2.microsoft.com/en-us/library/ms951262.aspx. [17] T. Yoo and S. Lafortune. Np-completeness of sensor selection problems arising in partially observed discrete-event systems. IEEE Trans. Auto. Control, 35(7), pages 797–806, 1990.